Replace cosign with sigstore-go #1806

rdimitrov · 2023-12-04T11:37:16Z

The following PR removes the use of cosign in favour of sigstore-go through introducing the concept of artifact verifiers.

Details:

Abstracted the artifact verification to happen through a new Verifier type:

Currently, there's sigstore, but the idea allows to easily add more verification backends for things like slsa, sbom, etc. through the ArtifactVerifier interface.
Verifiers are intended to be configurable, i.e. specify a custom trusted root repository for sigstore.
Easily add support for different types of artifacts. Currently, there's ArtifactTypeContainer but can be extended with artifacts like npm, etc.

Artifact version retention:

We now skip storing versions that have no tags in them since we cannot do anything on them
Changed the way we garbage collect artifact versions (so far anything older than 30days was deleted)
Updated the retention period to 6 months OR if there are leftover versions without any tag values.
Fixed a bug where the we were not getting all artifact versions - #1810

Other:

Fixed a bug where the Rekor log index was stored in a int32 variable (it's a float64)
Added an emptydir volume to our helm charts used for the TUF cache until sigstore-go has support for in-memory/no-cache mode. A unique tmp folder is created and deleted each time the verifier is instantiated to ensure we don't clash when scaling up/down.

What's left:

Parse the verification result and populate all of the needed values for signature and workflow info.
Update the artifact retention logic (do not store tag-empty artifacts, store tagged ones for more than 30 days, make sure we continue to handle the sig-before/after-artifact test case correctly)
Figure out if I can make sigstore-go run in in-memory mode only (allow for read-only file system)

Parked:

Sync with the sigstore-go community to figure out if the inclusionProof value from the bundle is needed when we do online verification. Update: The outcome is we should update eventually to v2 of the bundle format, but until that happens it's okay to use v1 (without the inclusionProof data) so we can migrate to v2 easily once this is cleared as a topic, i.e. we can fetch the rekor details from the OCI (waiting for support by cosign).

Fixes: #534
Fixes: #1810

stacklokbot

Minder analyzed this PR and found no vulnerable dependencies.

stacklokbot

Minder analyzed this PR and found no vulnerable dependencies.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-05T11:29:05Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

I remember seeing this in cosign before, it requires an upgrade to v2.

Just a note for outside of this issue 'no patched version exists yet.' I wonder if we should remove 'requested changes' when this sort of situation plays out?

That would be better 👍 Also it now added another comment when I pushed again.

Good idea, I filed #1860 so that we don't forget.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-05T13:06:13Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-05T13:21:19Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-05T14:26:50Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-05T21:17:43Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-05T21:17:53Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-05T22:19:33Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-05T22:19:45Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-05T22:19:55Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-05T22:20:05Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-05T22:25:01Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-06T00:22:29Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

rdimitrov · 2023-12-06T00:29:30Z

I now realise this PR got stretched up with fixes for some other issues I found during this implementation, so I'd understand if this is blocking and you'd want me to split the changes into smaller standalone PRs.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-06T10:20:13Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-07T11:37:36Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-07T21:56:09Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

JAORMX · 2023-12-08T06:55:24Z

deployment/helm/templates/deployment.yaml

@@ -126,6 +126,9 @@ spec:
      - name: identity-secrets
        secret:
          secretName: {{ .Values.deploymentSettings.secrets.identitySecretName }}
+      - name: sigstore-tuf-cache
+        emptyDir:
+          sizeLimit: 500Mi


awesome, thanks for doing this already!

JAORMX · 2023-12-08T06:57:24Z

internal/controlplane/handlers_githubwebhooks.go

@@ -893,6 +867,55 @@ func upsertVersionedArtifact(
 	return &dbArtifact, &dbVersion, nil
 }

+func processArtifactVersionConflicts(ctx context.Context, qtx db.Querier, dbArtifact db.Artifact, incomingTag string) error {


We can leave this function as-is for now. But, how often would this happen? I'm concerned this all happens in one transaction which might lead to us not processing the entries at all due to some in-between conflicts/errors.

I'm inclined to think this should be part of the processing, because if we had a conflict and we failed to fix it this means we cannot ensure that the profile evaluation afterwards for this artifact can be trusted.

internal/controlplane/handlers_githubwebhooks.go

JAORMX · 2023-12-08T07:00:01Z

internal/verifier/sigstore/sigstore.go

+
+const (
+	// SigstorePublicTrustedRootRepo is the public trusted root repository for sigstore
+	SigstorePublicTrustedRootRepo = "tuf-repo-cdn.sigstore.dev"


Let's leave this here for now. But... just saying... this would be a handy variable for the library.

Yeah, my intentions as well 👍

internal/verifier/verifier.go

JAORMX · 2023-12-08T07:11:17Z

proto/minder/v1/minder.proto

@@ -114,7 +114,7 @@ message SignatureVerification {
    optional string cert_identity = 4;
    optional string cert_issuer = 5;
    optional string rekor_log_id = 6;
-    optional int32 rekor_log_index = 7;
+    optional double rekor_log_index = 7;


I'm not sure this is the right data type to use for a rekor log index. @lukehinds can you double check this? In the rekor OpenAP spec [1] I see instances of integer while the golang API uses int64 [2]. Finally, the Rekor protobuf seems to point to an int64 as a log index [3]

[1] https://github.com/sigstore/rekor/blob/main/openapi.yaml#L184-L189
[2] https://github.com/sigstore/rekor/blob/main/pkg/api/api.go#L63
[3] https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_rekor.proto#L94

I think int64 is the right choice.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-08T08:46:23Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-08T08:46:33Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

JAORMX · 2023-12-08T08:50:15Z

@rdimitrov I'd advise you to squash the commits in this PR. It might start getting hard rebasing in the near future.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-08T08:56:45Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-08T09:00:32Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

rdimitrov · 2023-12-08T09:01:08Z

@rdimitrov I'd advise you to squash the commits in this PR. It might start getting hard rebasing in the near future.

Done! 👍

stacklokbot

Minder found vulnerable dependencies in this PR. Either push an updated
version or accept the proposed changes. Note that accepting the changes will
include Minder as a co-author of this PR.

stacklokbot · 2023-12-08T09:18:20Z

go.sum

-github.com/aws/aws-sdk-go v1.47.0 h1:/JUg9V1+xh+qBn8A6ec/l15ETPaMaBqxkjz+gg63dNk=
-github.com/aws/aws-sdk-go v1.47.0/go.mod h1:DlEaEbWKZmsITVbqlSVvekPARM1HzeV9PMYg15ymSDA=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.48.7 h1:gDcOhmkohlNk20j0uWpko5cLBbwSkB+xpkshQO45F7Y=


Vulnerability found, but no patched version exists yet.

lukehinds · 2023-12-11T11:36:23Z

deployment/helm/templates/deployment.yaml

@@ -102,6 +100,8 @@ spec:
            mountPath: /secrets/app
          - name: identity-secrets
            mountPath: /secrets/identity
+          - name: sigstore-tuf-cache
+            mountPath: /tmp/minder-cache


Might not be relevant, but do we need to be careful of tmp being world readable/writable?

@lukehinds this is an emptyDir volume and does not use the host's /tmp directory. I think this is fine as it's a dedicated folder for Minder and there's nothing else using it.

Signed-off-by: Radoslav Dimitrov <[email protected]>

dismissing stacklokbot's review as it's not actionable

stacklokbot reviewed Dec 4, 2023

View reviewed changes

stacklokbot reviewed Dec 5, 2023

View reviewed changes

rdimitrov force-pushed the sigstore-go branch from bb9e077 to 854e3b1 Compare December 5, 2023 11:28

stacklokbot suggested changes Dec 5, 2023

View reviewed changes

rdimitrov changed the title ~~WIP: Replace cosign with sigstore-go~~ Replace cosign with sigstore-go Dec 5, 2023

stacklokbot suggested changes Dec 5, 2023

View reviewed changes

rdimitrov force-pushed the sigstore-go branch from 75a4982 to b9d2d6f Compare December 5, 2023 21:17

stacklokbot suggested changes Dec 5, 2023

View reviewed changes

rdimitrov force-pushed the sigstore-go branch from ac01776 to 2288230 Compare December 5, 2023 22:24

stacklokbot suggested changes Dec 5, 2023

View reviewed changes

stacklokbot suggested changes Dec 6, 2023

View reviewed changes

eleftherias mentioned this pull request Dec 6, 2023

build(deps): bump github.com/sigstore/cosign/v2 from 2.2.1 to 2.2.2 #1827

Closed

stacklokbot suggested changes Dec 6, 2023

View reviewed changes

rdimitrov force-pushed the sigstore-go branch from 2b1021e to d06346f Compare December 7, 2023 11:37

stacklokbot suggested changes Dec 7, 2023

View reviewed changes

jhrozek mentioned this pull request Dec 7, 2023

When no fix for a CVE exists, don't mark a PR as changes requested #1860

Open

stacklokbot suggested changes Dec 7, 2023

View reviewed changes

JAORMX requested changes Dec 8, 2023

View reviewed changes

rdimitrov force-pushed the sigstore-go branch from 6ba7e36 to ac3b144 Compare December 8, 2023 08:46

stacklokbot suggested changes Dec 8, 2023

View reviewed changes

rdimitrov force-pushed the sigstore-go branch from ac3b144 to 1d64b02 Compare December 8, 2023 08:56

stacklokbot suggested changes Dec 8, 2023

View reviewed changes

rdimitrov force-pushed the sigstore-go branch from 1d64b02 to 0901a44 Compare December 8, 2023 09:00

stacklokbot suggested changes Dec 8, 2023

View reviewed changes

rdimitrov force-pushed the sigstore-go branch from 0901a44 to 667b763 Compare December 8, 2023 09:18

stacklokbot previously requested changes Dec 8, 2023

View reviewed changes

rdimitrov mentioned this pull request Dec 8, 2023

Minder to avoid commenting each time there's a change on a PR #1862

Closed

rdimitrov force-pushed the sigstore-go branch from 667b763 to 764fc3d Compare December 11, 2023 11:23

lukehinds previously approved these changes Dec 11, 2023

View reviewed changes

rdimitrov added 2 commits December 11, 2023 17:45

Replace cosign with sigstore-go and fix artifact retention policy

62ab864

Signed-off-by: Radoslav Dimitrov <[email protected]>

Use int64 for tlog index

66a4dba

Signed-off-by: Radoslav Dimitrov <[email protected]>

rdimitrov dismissed lukehinds’s stale review via 66a4dba December 11, 2023 15:45

rdimitrov force-pushed the sigstore-go branch from 764fc3d to 66a4dba Compare December 11, 2023 15:45

rdimitrov requested review from JAORMX, lukehinds and jhrozek December 11, 2023 15:51

JAORMX approved these changes Dec 11, 2023

View reviewed changes

jhrozek approved these changes Dec 11, 2023

View reviewed changes

rdimitrov merged commit adc7e3a into mindersec:main Dec 11, 2023
15 checks passed

rdimitrov deleted the sigstore-go branch December 11, 2023 17:05

Replace cosign with sigstore-go #1806

Replace cosign with sigstore-go #1806

Conversation

rdimitrov commented Dec 4, 2023 • edited Loading

stacklokbot left a comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rdimitrov commented Dec 6, 2023

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

JAORMX commented Dec 8, 2023

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stacklokbot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rdimitrov commented Dec 8, 2023

stacklokbot left a comment

rdimitrov commented Dec 4, 2023 •

edited

Loading